fardeak neelsun xolani
Shanta Plansinis
A security researcher Youssef Sammouda (Samm0uda) recently discovered a critical CSRF (Cross-site Request Forgery) security vulnerability on Facebook. This security issue could have been used to take over any Facebook user account. Samm0uda reported the bug on January 26 and Facebook fixed it just 5 days later. On February 12, Facebook awarded Samm0uda with $25,000 bounty for finding and reporting this issue. Seemingly, nobody exploited the vulnerability before it was fixed.
For the attack to be successful, the attacker would have had to trick a user into visiting a malicious URL. The URL could have been generic, so it could have been sent to millions of users at the same time. Also, the URL domain would have been facebook.com, so it would have been easy to trick a Facebook user into believing that this is a legitimate address.
The CSRF vulnerability was discovered by Samm0uda in the _DONOTUSE/?url= endpoint. If you supplied another endpoint as , a POST request would have been made to it and a CSRF token fb_dtsg would have been added to the request body.
The bigger your application code, the more chances of security risks. For example, Facebook learns about hundreds of vulnerabilities annually just from third parties. Samm0uda alone received 16 bounties from Facebook just in January and February for reporting security issues.
This vulnerability proves once again, how dangerous CSRF attacks can be and how important it is to protect yourself against them. To check your website or web application for vulnerabilities, you can use the Acunetix vulnerability scanner, which includes a CSRF scanner.
Researchers has disclosed a severe vulnerability in the Facebook messenger for Windows that lets hackers to hijack calls easily and then install malware and it is a vicious threat that grants the hackers to remain undetected on the application.
Moreover, this vulnerability has a code that was executed by the app, which helps the hackers to get access to the application efficiently; once they gain control over the app, next, they install the malware to operate it.
During the investigation, the security experts said that they came across a call to place the Powershell.exe from the Python27 list and the PowerShell gets generated while downloading python version 2.7.
This is the most essential step in this kind of vulnerability, as an attacker has to take orders to make sure that he/she will not miss any connection with the remote workstation. But, all the methods that are used in windows are quite similar; not only this, they are also recognized as registry keys, auto-start services, scheduled tasks, and several more.
If we compare the second stage of this vulnerability, then it is more complicated then the previous one. Well, in this stage, the hackers try to obtain a binary that will create an unwanted call to a method or a DLL, which allows the threat actors to hijack the call to run an ill-disposed file.
Moreover, currently, Facebook Messenger has 1.3 billion active users in a month, which implies that the accounts for all users beyond devices get multiple access to the service by their Windows-based machines.
We all are very familiar with Facebook and its messenger app, as it is one of the most popular messaging apps in the world. Billions of users use Facebook in the whole world, and this kind of vulnerability may harm the users, as this vulnerability are highly risky.
Ever regretted hitting the Send/Enter button just a little too quickly on Facebook Messenger? Wouldn't you love having a way to modify your sent messages? Even better, what if Facebook lets you delete the messages from the receiver's end. It would be awesome getting rid of all those embarrassing messages you might have sent to someone you once had a crush on. If you have been plotting about a possible account takeover to remove the messages you have sent, researchers have come to your aid, saying that it is indeed possible.
Researchers from the security firm Check Point have shown that you can modify or change the messages after you have hit the Send button in Facebook Messenger. Roman Zaikin, a security researcher shared that a simple HTML tweak could be used to modify or delete messages, photos, files, and links from the target's Facebook account.
The issue stems from how Facebook assigns identities to chat messages. Each of the messages in Facebook Messenger has a unique "message_id" identifier that an attacker could obtain by sending a request to www.facebook.com/ajax/mercury/thread_info.php. Attacker can send a modified message using the same ID, thereby replacing the previous message. Facebook would then consider the new message as legitimate and remove the original message content.
While a simple bug, it could be exploited to send malicious links that could then lead to malware installation on the victim's devices. Researchers have released a proof-of-concept video that shows the Facebook Messenger vulnerability in action.
Facebook has rated the vulnerability as low risk. An interesting exploit, it could lead to severe consequences for target users. For one, it could lead to fraud campaigns that will change the legitimate links and files with malicious content. "Hackers can tamper, alter or hide important information in Facebook chat communications which can have legal repercussions. These chats can be admitted as evidence in legal investigations and this vulnerability opened the door for an attacker to hide evidence of a crime or even incriminate an innocent person," Check Point research team noted.
The security research firm claims that the flaw affected both the web and mobile versions of the messaging application. However, Facebook has said that it only impacted the Android app of Facebook Messenger, and that the "message duplication" can only be exploited to change your own messages, not someone else's. In a blog post published earlier today, Facebook shared;
This bug affected the Android Messenger interface, but the message content was still correctly reflected on other platforms. We also confirmed that the content self-corrected on Android when the application refetched message data from the server, so it wasn't permanently changed.
The researchers informed Facebook about this vulnerability earlier this month, and the social networking giant has already fixed the issue. "Based on our investigation, this simple misconfiguration in the Messenger app on Android turned out to be a low risk issue and it's already been fixed," Facebook said.
c01484d022